ticktick

maintainer Aerz · 21 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt proprietary binary .deb from a CloudFront CDN URL (d2atcrkye2ik4e.cloudfront.net). This is the official TickTick Linux download endpoint (matching the official download page at ticktick.com/download), so it is not a personal or rogue host. However, CloudFront distributions can be reassigned, and the URL is not a canonical vendor domain. The package installs an Electron-based binary application directly into the system, which is executed code from a non-first-party domain. SHA256 checksums are present and pinned, which mitigates substitution risk significantly. The pattern (official app distributed via CDN with pinned checksums) is common and legitimate for proprietary Electron apps in the AUR. The medium rating is marginally justified by the CDN indirection for an executed binary, but the pinned hashes and official vendor association keep this from being a clear threat. Retaining medium as the CDN host is not the canonical vendor domain and the binary is executed code.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("${pkgname}-${pkgver}-amd64.deb::https://d2atcrkye2ik4e.cloudfront.net/download/linux/linux_deb_x64/${pkgname}-${pkgver}-amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): The PKGBUILD downloads a prebuilt proprietary binary .deb from a CloudFront CDN URL (d2atcrkye2ik4e.cloudfront.net). This is the official TickTick Linux download endpoint (matching the official download page at ticktick.com/download), so it is not a personal or rogue host. However, CloudFront distributions can be reassigned, and the URL is not a canonical vendor domain. The package installs an Electron-based binary application directly into the system, which is executed code from a non-first-party domain. SHA256 checksums are present and pinned, which mitigates substitution risk significantly. The pattern (official app distributed via CDN with pinned checksums) is common and legitimate for proprietary Electron apps in the AUR. The medium rating is marginally justified by the CDN indirection for an executed binary, but the pinned hashes and official vendor association keep this from being a clear threat. Retaining medium as the CDN host is not the canonical vendor domain and the binary is executed code.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Agustin Cisneros <agustincc@tutanota.com>
    
      2
    
      3pkgname=ticktick
    
      4pkgver=8.0.10
    
      5pkgrel=1
    
      6pkgdesc='Official desktop application for Linux'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://ticktick.com/download'
    
      9license=('custom:Proprietary')
    
      10install=ticktick.install
    
      11conflicts=('ticktick-nativefier')
    
      12depends=('gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'xdg-utils' 'libatspi.so'
    
      13  'util-linux-libs' 'libappindicator-gtk3' 'libsecret')
    
      14source=('ticktick.sh' 'LICENSE')
    
      15source_x86_64=("${pkgname}-${pkgver}-amd64.deb::https://d2atcrkye2ik4e.cloudfront.net/download/linux/linux_deb_x64/${pkgname}-${pkgver}-amd64.deb")
    
      16source_aarch64=("${pkgname}-${pkgver}-arm64.deb::https://d2atcrkye2ik4e.cloudfront.net/download/linux/linux_deb_arm64/${pkgname}-${pkgver}-arm64.deb")
    
      17sha256sums=('422ab230ea6a54ba9a44db25b1395d71bd52fc3add0cab13bbc95d86f769416e'
    
      18            '2d866fcb749c30d931fa96cc1578869b3fa9fc61a5c5f30e0316ddb00abb5814')
    
      19sha256sums_x86_64=('e732212e9a2a64cf3e442e18061743c8cab6684837d4ef14e90e600fc068f5eb')
    
      20sha256sums_aarch64=('47d74c1948925d7fc245f557a16df0d8693551f9277e6356a08aa484bfc5449b')
    
      21
    
      22package() {
    
      23  tar -xf data.tar.xz -C "${pkgdir}"
    
      24
    
      25  # Replace default path to system symlink
    
      26  sed -i "s|^Exec=.*|Exec=/usr/bin/${pkgname} --uri=%U|" "${pkgdir}/usr/share/applications/ticktick.desktop"
    
      27
    
      28  # Copy launch script to allow custom flags
    
      29  install -Dm 755 ticktick.sh "${pkgdir}/usr/bin/ticktick"
    
      30
    
      31  # Install license from https://ticktick.com/about/tos
    
      32  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      33
    
      34  mv "${pkgdir}/opt/TickTick/LICENSE.electron.txt" \
    
      35    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      36  mv "${pkgdir}/opt/TickTick/LICENSES.chromium.html" \
    
      37    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      38
    
      39  # SUID chrome-sandbox for Electron 5+
    
      40  chmod 4755 "${pkgdir}/opt/TickTick/chrome-sandbox"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2